ME Analyzer: Intel Engine Firmware Analysis Tool Discussion

ME Analyzer v1.9.0

@ all:

This thread is now a discussion topic only and just links to github for everything else.

To download MEA, report bugs, recommend new functionality etc go to the Githubā€™s Issues page. Anything not strictly MEA related should be discussed here and not github.

Changelogs wonā€™t be posted here anymore. I urge you to Follow the twitter account @platomaniac for news and/or Watch the project over at Github for detailed changelogs and pre-build releases.

hello.
MEA 1.10.x support 64bit Windows only ?
could not work on Windows 7 32bit.

@fylgja

Try the executable attached below and let me know if it works.

I tried attached file, but same error.

MEA109(MEA1.0.9) is ā€œ32 bit executableā€ (Win32)
MEA110(MEA1.1.0) is ā€œ64 bit executableā€ (Win64)

Should be ok now

MEA.rar (3.81 MB)

Works fine ! Thanks !

Hi!!!
Iā€™m getting this error:
"This version of E:\Firmware\iME\MEA\MEA.exe is not compatible with the version of Windows youā€™re running. Check your computerā€™s system information and contact o software publisher."

My system: Windows 10, 32 bits
MEA version: 1.10.1

Thanks!!!

Hello, please download the newly released v1.10.2

@ all

Starting from version 1.11.0, MEA will no longer support SPS firmware. It will detect SPS but only display very basic info. Remember that MEA is open source so you can fork the current branch or just visit the current (1.10.2) commit in the future and download the python script manually if you so desire. This also means that people donā€™t need to report any firmware not in db (MEA wonā€™t check for SPS regardless), unless any error is shown or the family (SPS) is not properly detected in future 5.x major branches or similar.

Whats does PV FD and VCN stand for?

Some of the outputs of this tool are somewhat clear, but others are clear as mud, both the label like above or the values it reports.
Could you clarify the meaning of these?

Production Version, Flash Descriptor, Version Control Number

Hi there,

ME Analyzer says i should "report this issue!"ā€¦ so this is what i am going to do now :wink:

ME Analyzer: v1.10.2
Database: r83

I dumped my BIOS (Asus Gryphon Z87) with AfuWinx64. When i try to load the BIOS it gives me the following error: "Found unidentifiable Intel Engine Firmware". When i load the stock BIOS from the ASUS homepage everything is okay.
If i open the dumped BIOS with UEFITool and have a look at the "ME region" it is just filled with FF. I really dunno if it has to be this way but i think you should consider implementing a separate "error" message for this case?

When AFU tries to dump the entire SPI image and the Flash Descriptor is locked (locked ME read/write access), it dumps whatever it can and just fills the locked/non-dumped sections with padding. That is a stupid practice which confuses unaware people. Flash Programming Tool and Flashrom show proper errors when that occurs. In the case of ā€œpartialā€ AFU dumps, MEA detects a ME region with a starting and ending offset but itā€™s empty so it shows the ā€œunidentifiableā€ error.

Hmā€¦ strangeā€¦ MEInfo isnā€™t showing any FD info at all?

But you are right! It says:

1
2
Ā 
Host Read Access to ME:                 Disabled
Host Write Access to ME: Disabled
Ā 


But when the FD is locked i shouln'd be able to flash a mod BIOS?

Hello!

C. Download ME Analyzer

ME Analyzer is developed using Python 3.x and can work under Windows, Linux and macOS operating systems. Pre-built binaries are provided for Windows only with build/freeze instructions for all three OS found below.

But I see only archive upper on this thread, no current binaries. Tried to assemble it via provided manual, but it not finished successfully.
Can you please upload binaries somewhere and provide a link to get it? Iā€™m not a python-programmer, so see no way how to fix that error :frowning:

UPD: Successfuly built it with Python 3.5.3 version, 3.6.1 is not supported by current PyInstaller. Maybe that can be noted in readme.
Really, itā€™s so linux-way - to get a little program get a big developer suite, get a strange error, f**k with dependencies (oops, you need not a latest version, so get another big suite) - why not get just a binary if you need just a binary ? Open source is great, I like it - but if need to run program, not just learn code, precompiled binaries is what to download first.

Here is logs:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
Ā 
>pyinstaller --noupx --onefile MEA.py
114 INFO: PyInstaller: 3.2.1
114 INFO: Python: 3.6.1
115 INFO: Platform: Windows-7-6.1.7601-SP1
116 INFO: wrote e:\My downloads\BIOS\MEAnalyzer\MEA.spec
118 INFO: UPX is not available.
120 INFO: Extending PYTHONPATH with paths
['e:\\My downloads\\BIOS\\MEAnalyzer', 'e:\\My downloads\\BIOS\\MEAnalyzer']
120 INFO: checking Analysis
120 INFO: Building Analysis because out00-Analysis.toc is non existent
120 INFO: Initializing module dependency graph...
122 INFO: Initializing module graph hooks...
124 INFO: Analyzing base_library.zip ...
Traceback (most recent call last):
File "D:\Soft\Python36\Scripts\pyinstaller-script.py", line 11, in <module>
load_entry_point('PyInstaller==3.2.1', 'console_scripts', 'pyinstaller')()
File "d:\soft\python36\lib\site-packages\PyInstaller\__main__.py", line 90, in run
run_build(pyi_config, spec_file, **vars(args))
File "d:\soft\python36\lib\site-packages\PyInstaller\__main__.py", line 46, in run_build
PyInstaller.building.build_main.main(pyi_config, spec_file, **kwargs)
File "d:\soft\python36\lib\site-packages\PyInstaller\building\build_main.py", line 788, in main
build(specfile, kw.get('distpath'), kw.get('workpath'), kw.get('clean_build'))
File "d:\soft\python36\lib\site-packages\PyInstaller\building\build_main.py", line 734, in build
exec(text, spec_namespace)
File "<string>", line 16, in <module>
File "d:\soft\python36\lib\site-packages\PyInstaller\building\build_main.py", line 212, in __init__
self.__postinit__()
File "d:\soft\python36\lib\site-packages\PyInstaller\building\datastruct.py", line 161, in __postinit__
self.assemble()
File "d:\soft\python36\lib\site-packages\PyInstaller\building\build_main.py", line 317, in assemble
excludes=self.excludes, user_hook_dirs=self.hookspath)
File "d:\soft\python36\lib\site-packages\PyInstaller\depend\analysis.py", line 560, in initialize_modgraph
graph.import_hook(m)
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 1509, in import_hook
source_package, target_module_partname, level)
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 1661, in _find_head_package
target_module_headname, target_package_name, source_package)
File "d:\soft\python36\lib\site-packages\PyInstaller\depend\analysis.py", line 209, in _safe_import_module
module_basename, module_name, parent_package)
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 2077, in _safe_import_module
module_name, file_handle, pathname, metadata)
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 2167, in _load_module
self._scan_code(m, co, co_ast)
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 2585, in _scan_code
module, module_code_object, is_scanning_imports=False)
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 2831, in _scan_bytecode
global_attr_name = get_operation_arg_name()
File "d:\soft\python36\lib\site-packages\PyInstaller\lib\modulegraph\modulegraph.py", line 2731, in get_operation_arg_name
return module_code_object.co_names[co_names_index]
IndexError: tuple index out of range
Ā 



Did you check the linked github page?
In releases you can download the latest windows executable which is in ME_Analyzer_v1.11.1.rar.

Hi,
I have some problem about running ME Analyzer on Mac. I canā€™t pass file argument to ./MEA in terminal (here is my command: $./MEA lenovo.bin) it keeps saying Syntax Error: unexpected EOF

Screen Shot 2017-05-12 at 12.09.45 AM.png

while parsing. Do you have any ideas with this issue?

Hello,

I donā€™t have adequate Linux and MacOS experience to help quickly but try these:

1) Make sure the script is running under Python 3 and not 2
2) Try to also input parameter ā€œ-skipā€ after the filepath
3) Try to type the full filepath without the tilde or similar
4) Try to place the image at the same folder as MEA

@plutomaniac

Hello! :))

dsc1.jpg


Maybe I missed something, but is there a newer version of FW ME 9.0?